@bongos/core 1.19.512 → 1.19.514

package/modules/hall-ui/public/style.css

@@ -1944,24 +1944,110 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
   grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
   gap: 12px;
 }
-.curve__chart {
-  background: var(--surface-2);
-  border-radius: var(--radius-sm);
-  padding: 10px 14px 12px;
+/* ---------- hall-kit charts (task 1003445) ----------
+   The hall's ONE chart vocabulary. Before this the same horizontal bar was
+   written three times — the Curve's kinds, Watch's Review-quality trend, and
+   the profile's craft mix — each with its own class family, geometry and tone,
+   and the line chart a fourth family beside them.
+
+   Three deliberate changes came with the merge, all of them the kit's defaults
+   winning over a copy that had drifted: every row now holds the hall's 24px
+   FLOOR (only the profile's copy remembered it, so the Curve's kind rows grow
+   a few px), the hover dim applies to all three rather than the profile alone,
+   and the value cell right-aligns (a no-op where its column is `auto`).
+   Everything else is declaration-for-declaration what the three families
+   said. */
+
+.kit-chart { background: var(--surface-2); border-radius: var(--radius-sm); padding: 10px 14px 12px; }
+.kit-chart__title { font-size: 12px; font-weight: 600; color: var(--ink-soft); margin: 0 0 6px; }
+.kit-chart__empty { font-size: 12px; color: var(--ink-faint); }
+.kit-chart__foot { font-size: 11.5px; color: var(--ink-faint); margin-top: 4px; }
+
+.kit-spark { width: 100%; height: 44px; display: block; }
+/* The stroke/fill here are the FALLBACK: sparklineHtml writes the caller's
+   colour inline, because the Curve spends a different accent per chart. */
+.kit-spark__line { fill: none; stroke: var(--accent); stroke-width: 2; }
+.kit-spark__area { fill: color-mix(in srgb, var(--accent) 14%, transparent); stroke: none; }
+
+/* Every difference between the three call sites is one of these six custom
+   properties, which is what makes the fifth chart free: pass barSeriesHtml's
+   labelWidth / valueWidth / barHeight / radius / track options, never a new
+   class. */
+.kit-bars {
+  --kit-bars-label-w: 110px;
+  --kit-bars-val-w: auto;
+  --kit-bars-h: 8px;
+  --kit-bars-radius: 4px;
+  --kit-bars-track: var(--surface-2);
+  --kit-bars-fill: var(--accent);
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+.kit-bars__row {
+  display: grid;
+  grid-template-columns: var(--kit-bars-label-w) minmax(0, 1fr) var(--kit-bars-val-w);
+  align-items: center;
+  gap: 10px;
+  /* The hall's 24px floor, held here so no call site has to remember it —
+     the profile's mix was the only one of the three that did. */
+  min-height: 24px;
+  font-size: 12.5px;
+  font-variant-numeric: tabular-nums;
 }
-.curve__chart-title { font-size: 12px; font-weight: 600; color: var(--ink-soft); margin: 0 0 6px; }
-.curve__chart-empty { font-size: 12px; color: var(--ink-faint); }
-.curve__chart-foot { font-size: 11.5px; color: var(--ink-faint); margin-top: 4px; }
-.spark { width: 100%; height: 44px; display: block; }
-.spark__line { fill: none; stroke: var(--accent); stroke-width: 2; }
-.spark__area { fill: color-mix(in srgb, var(--accent) 14%, transparent); stroke: none; }
+.kit-bars__label { color: var(--ink-soft); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.kit-bars__track {
+  display: block;
+  height: var(--kit-bars-h);
+  background: var(--kit-bars-track);
+  border-radius: var(--kit-bars-radius);
+  overflow: hidden;
+}
+.kit-bars__fill {
+  display: block;
+  height: 100%;
+  background: var(--kit-bars-fill);
+  border-radius: var(--kit-bars-radius);
+  /* A re-render (an SSE nudge, a lookback change) grows the bar to its new
+     width rather than jumping. First paint does not animate: a freshly
+     inserted element has no previous width to transition from. The hall's ONE
+     reduced-motion kill switch (§the kill switch, at the end of this sheet)
+     already zeroes this with !important — do NOT add a second @media block
+     here, which is what `tests/hall_tokens.mjs` forbids and why the rule
+     cannot rot in two places. */
+  transition: width 200ms ease;
+}
+.kit-bars__row:hover .kit-bars__fill { opacity: .8; }
+.kit-bars__val { text-align: right; color: var(--ink-faint); }
+/* The neutral tone: a series read as data rather than as the page's own
+   accent — Watch's trend, where the accent belongs to the pressable. */
+.kit-bars--neutral {
+  --kit-bars-track: var(--rule-soft);
+  --kit-bars-fill: var(--ink-soft);
+}
+.kit-bars--neutral .kit-bars__val { color: var(--ink); }
+
+/* The PLOT: a step line or a column series on a time axis. Moved verbatim from
+   profile.css's .pchart__* (task 1003445), where the same frame was drawn twice
+   by profile-charts.js. The dataviz spec here is measured, not chosen — a 2px
+   accent line, a 10% wash, a hairline solid axis, an r=4 end dot with a 2px
+   card-coloured ring, and the ONE labelled value in ink rather than the series
+   colour. tests/hall_kit_charts.mjs pins all five; do not hand-tune one.
+   `tabindex` is on the svg because the chart is walkable by arrow key, so the
+   focus ring is a real control's, not decoration. */
+.kit-plot { display: block; width: 100%; height: auto; overflow: visible; border-radius: var(--radius-sm); }
+.kit-plot:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.kit-plot__line { fill: none; stroke: var(--accent); stroke-width: 2; stroke-linejoin: round; stroke-linecap: round; }
+.kit-plot__area { fill: color-mix(in srgb, var(--accent) 10%, transparent); stroke: none; }
+.kit-plot__axis, .kit-plot__hair { stroke: var(--rule-soft); stroke-width: 1; }
+.kit-plot__hair { stroke: var(--ink-faint); }
+.kit-plot__dot { fill: var(--accent); stroke: var(--bg-card); stroke-width: 2; }
+.kit-plot__col { fill: var(--accent); }
+.kit-plot__col--empty { fill: var(--rule-soft); }
+.kit-plot__end { font-family: var(--font-body); font-size: 11.5px; font-weight: 500; fill: var(--ink); }
+.kit-plot__tick { font-family: var(--label-face); font-size: 10px; letter-spacing: var(--label-space); text-transform: var(--label-case); fill: var(--ink-faint); }
 
 .curve__kinds { display: flex; flex-direction: column; gap: 6px; margin-top: 16px; }
-.curve__kind { display: grid; grid-template-columns: 110px minmax(0, 1fr) auto; align-items: center; gap: 10px; font-size: 12.5px; }
-.curve__kind-label { color: var(--ink-soft); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
-.curve__kind-bar { height: 8px; background: var(--surface-2); border-radius: 4px; overflow: hidden; }
-.curve__kind-fill { height: 100%; background: var(--accent); border-radius: 4px; }
-.curve__kind-n { color: var(--ink-faint); font-variant-numeric: tabular-nums; }
 
 /* ---------- onboarding checklist ---------- */
 

package/modules/hall-ui/public/watch.css

@@ -55,20 +55,12 @@
 /* The 14-day grade trend: a day, a bar, then the count and score. The bar is a
    measurement, not a control, so it is ink on a hairline track and never the
    accent. */
-.watch-trend { display: flex; flex-direction: column; margin-top: 4px; }
-.watch-trend__row {
-  display: grid;
-  grid-template-columns: 64px minmax(0, 1fr) 96px;
-  gap: 12px;
-  align-items: center;
-  min-height: 28px;
-  font-size: 13px;
-  color: var(--ink-soft);
-  font-variant-numeric: tabular-nums;
-}
-.watch-trend__bar-track { height: 6px; overflow: hidden; border-radius: var(--radius-pill); background: var(--rule-soft); }
-.watch-trend__bar-fill { display: block; height: 100%; background: var(--ink-soft); }
-.watch-trend__val { text-align: right; color: var(--ink); }
+/* The Review-quality trend is OTBKit.barSeriesHtml in its neutral tone (task
+   1003445) — the .watch-trend family was the hall's second copy of one
+   horizontal bar. What stays here is this page's own density: a taller row and
+   more air between the three columns than the kit's default. */
+#mason-marks-trend .kit-bars { margin-top: 4px; gap: 0; }
+#mason-marks-trend .kit-bars__row { min-height: 28px; gap: 12px; font-size: 13px; }
 
 /* A link inside a ledger cell (a session's tasks) is a control at a 13.5px line
    box: the padding buys the 24px floor and the negative margin hands it back. */

package/modules/hall-ui/public/watch.html

@@ -59,7 +59,7 @@
           <!-- 1. ACCESS REQUESTS -->
           <section class="scroll" id="gate-scroll" aria-labelledby="gate-h" hidden>
             <h2 id="gate-h" class="scroll__h">Access requests</h2>
-            <p class="scroll__lede">People asking to join. Approve or dismiss each request.</p>
+            <p class="scroll__lede">People asking to join. Approve or dismiss each request, re-read the ones you already decided, and take back an approval before that person has signed in.</p>
             <div id="gate-body"><span class="kit-skel"></span></div>
           </section>
 

package/modules/hall-ui/public/watch.js

@@ -26,6 +26,14 @@
 // family's .ov-figs, every sub-section is an .ov-group head, the access requests
 // are oversight rows, and the five most recent sessions the page always fetched
 // and threw away are now rendered under the tally.
+//
+// TASK 1002332 made the access-requests section a REVIEW queue rather than a
+// decision button: every row says whether the platform vouched for the name on
+// it (ADR 0201 — the public unauthenticated write means anyone may apply as
+// anyone, so vouched/unvouched is load-bearing, not decoration), the three
+// lifecycle states sit behind one switch, and an approval can be RESCINDED
+// before its holder ever signs in — a transition the route has always taken and
+// nothing on this page offered (ADR 0208).
 
 (() => {
   'use strict';
@@ -43,7 +51,7 @@
   const { escapeHtml, $, num, fmtInt, fmtCompact } = window.OTB;
   // Shared component kit (hall-kit.js, task 2166): tabs, ledger, pager, empty
   // states — adopted here by task 2173, and by every list since task 1003469.
-  const { makeTabs, makeLedger, makePager, emptyStateHtml } = window.OTBKit;
+  const { makeTabs, makeLedger, makePager, makeFilterBar, emptyStateHtml } = window.OTBKit;
   const fmtDate = (iso) => window.OTB.fmtDate(iso, { time: true });
   const rankLabel = (rank) => window.OTB.rankLabel(rank, { empty: '' });
   const toast = (msg) => window.OTB.toast(msg);
@@ -291,50 +299,131 @@
     });
   }
 
-  // One request, one oversight row: who, their note as the sub line, when they
-  // asked as the fact, and the two decisions on the right.
+  // The three lists the queue is, behind one switch. Reviewing is not only
+  // deciding: an owner has to re-read what they already decided, and RESCIND an
+  // approval given by mistake before the applicant ever signed in — the route
+  // has always taken that transition (ADR 0201 D4.2) and nothing offered it,
+  // because this page only ever fetched `?status=pending` (ADR 0208).
+  const GATE_VIEWS = [
+    { value: 'pending', label: 'Waiting', empty: 'No pending access requests.' },
+    { value: 'invited', label: 'Admitted', empty: 'Nobody has been admitted yet.' },
+    { value: 'dismissed', label: 'Declined', empty: 'No declined requests.' },
+  ];
+  let gateView = 'pending';
+
+  function gateEmptyMsg() {
+    return (GATE_VIEWS.find((v) => v.value === gateView) || GATE_VIEWS[0]).empty;
+  }
+
+  // The switch itself, rebuilt on every render because `section` replaces the
+  // whole body — the same lifecycle wireInviteForm already lives with.
+  function wireGateView(target) {
+    const mount = target.querySelector('#gate-view');
+    if (!mount) return;
+    makeFilterBar({
+      mount,
+      primary: [{
+        id: 'gate-status',
+        label: 'Show',
+        value: gateView,
+        options: GATE_VIEWS.map((v) => ({ value: v.value, label: v.label })),
+      }],
+      onChange: (vals) => {
+        const next = vals['gate-status'];
+        if (next === gateView) return;
+        gateView = next;
+        loadGate();
+      },
+    });
+  }
+
+  // Whether the platform vouched for this applicant, said on the row — and the
+  // single thing that makes the queue safe to read (ADR 0201, Consequences).
+  // POST /access-requests is the one PUBLIC unauthenticated write, so anyone may
+  // file a request under anyone's name; a row that merely LOOKED vouched is the
+  // whole impersonation surface the vouch exists to close. It is never authority
+  // (ADR 0016) — an unvouched applicant is admitted by the identical statement —
+  // it only says whether anyone confirmed who is asking.
+  function vouchPill(vouched) {
+    return vouched
+      ? '<span class="fact-pill fact-pill--ok" title="The platform confirmed this request came from the account it names.">Identity vouched</span>'
+      : '<span class="fact-pill fact-pill--warn" title="Nobody vouched for this name — anyone can file a request naming anyone. Confirm who is asking before you admit them.">Name unvouched</span>';
+  }
+
+  // What this row still offers. A waiting request has two decisions; an admitted
+  // one can still be rescinded (until they sign in, after which the server
+  // refuses and says so); a declined one is terminal here — re-admitting is the
+  // invite form above, which is what the server's own refusal names.
+  function gateRowActions(r) {
+    const id = escapeHtml(r.id);
+    if (r.status === 'invited') {
+      return ghost(`data-gate-action="dismissed" data-gate-from="invited" data-id="${id}"`, 'Rescind', true);
+    }
+    if (r.status === 'dismissed') return '';
+    return ghost(`data-gate-action="invited" data-id="${id}"`, 'Invite')
+      + ghost(`data-gate-action="dismissed" data-id="${id}"`, 'Dismiss', true);
+  }
+
+  // One request, one oversight row: who, whether anyone vouched for them, their
+  // note as the sub line, when they asked (and who decided, once someone has) as
+  // the facts, and whatever decisions are still open on the right.
+  function gateRowHtml(r) {
+    const who = r.display_name
+      ? `${escapeHtml(r.display_name)}<span class="ov-mono">@${escapeHtml(r.github_login)}</span>`
+      : `<span class="ov-mono">@${escapeHtml(r.github_login)}</span>`;
+    const note = r.note ? `<p class="ov-row__sub">“${escapeHtml(r.note)}”</p>` : '';
+    // A rescind overwrites the approver with the rescinder (ADR 0208), so this
+    // names who put the row in the state it is in now — which is what it says.
+    const by = r.resolved_by_login ? ` by <span class="ov-mono">@${escapeHtml(r.resolved_by_login)}</span>` : '';
+    const decided = r.resolved_at
+      ? `<span class="ov-row__when">${r.status === 'invited' ? 'Admitted' : 'Declined'} ${escapeHtml(fmtDate(r.resolved_at))}${by}</span>`
+      : '';
+    const actions = gateRowActions(r);
+    return (
+      `<li class="ov-row" data-req-id="${escapeHtml(r.id)}">` +
+      '<div class="ov-row__main">' +
+      `<span class="ov-row__title">${who}</span>` +
+      note +
+      '<div class="ov-row__facts">' +
+      vouchPill(!!r.vouched) +
+      `<span class="ov-row__when">Asked ${escapeHtml(fmtDate(r.created_at))}</span>` +
+      decided +
+      '</div>' +
+      '</div>' +
+      (actions ? `<div class="ov-row__right"><div class="ov-row__actions">${actions}</div></div>` : '') +
+      '</li>'
+    );
+  }
+
   function renderGate(data, target) {
     const requests = Array.isArray(data.requests) ? data.requests : [];
-    setAttention('att-access', requests.length); // tile count = table content
-    if (!requests.length) {
-      target.innerHTML = inviteFormHtml() + emptyStateHtml('No pending access requests.');
-      wireInviteForm(target);
-      return;
+    // The attention tile counts WAITING work, never whatever list is on screen:
+    // reading the decided history must not repaint the board with a number that
+    // means something else. Its own sub line says "pending".
+    if (gateView === 'pending') setAttention('att-access', requests.length);
+    const head = inviteFormHtml() + '<div id="gate-view"></div>';
+    target.innerHTML = requests.length
+      ? head + '<ul class="ov-rows">' + requests.map(gateRowHtml).join('') + '</ul>'
+      : head + emptyStateHtml(gateEmptyMsg());
+
+    if (requests.length) {
+      wireActions(target, '[data-gate-action]', async (btn) => {
+        const id = btn.getAttribute('data-id');
+        const status = btn.getAttribute('data-gate-action');
+        const rescinding = btn.getAttribute('data-gate-from') === 'invited';
+        await patchJson(`/access-requests/${encodeURIComponent(id)}`, { status });
+        toast(status === 'invited' ? 'Builder invited.'
+          : rescinding ? 'Approval rescinded — that sign-in no longer gets in.'
+            : 'Request dismissed.');
+        await loadGate();
+      }, 'Could not resolve');
     }
-    target.innerHTML = inviteFormHtml() + '<ul class="ov-rows">' + requests
-      .map((r) => {
-        const who = r.display_name
-          ? `${escapeHtml(r.display_name)}<span class="ov-mono">@${escapeHtml(r.github_login)}</span>`
-          : `<span class="ov-mono">@${escapeHtml(r.github_login)}</span>`;
-        const note = r.note ? `<p class="ov-row__sub">“${escapeHtml(r.note)}”</p>` : '';
-        return (
-          `<li class="ov-row" data-req-id="${escapeHtml(r.id)}">` +
-          '<div class="ov-row__main">' +
-          `<span class="ov-row__title">${who}</span>` +
-          note +
-          `<div class="ov-row__facts"><span class="ov-row__when">Asked ${escapeHtml(fmtDate(r.created_at))}</span></div>` +
-          '</div>' +
-          '<div class="ov-row__right"><div class="ov-row__actions">' +
-          ghost(`data-gate-action="invited" data-id="${escapeHtml(r.id)}"`, 'Invite') +
-          ghost(`data-gate-action="dismissed" data-id="${escapeHtml(r.id)}"`, 'Dismiss', true) +
-          '</div></div>' +
-          '</li>'
-        );
-      })
-      .join('') + '</ul>';
-
-    wireActions(target, '[data-gate-action]', async (btn) => {
-      const id = btn.getAttribute('data-id');
-      const status = btn.getAttribute('data-gate-action');
-      await patchJson(`/access-requests/${encodeURIComponent(id)}`, { status });
-      toast(status === 'invited' ? 'Builder invited.' : 'Request dismissed.');
-      await loadGate();
-    }, 'Could not resolve');
     wireInviteForm(target);
+    wireGateView(target);
   }
 
   function loadGate() {
-    return section($('#gate-body'), () => fetchJson('/access-requests?status=pending'), renderGate, {
+    return section($('#gate-body'), () => fetchJson(`/access-requests?status=${encodeURIComponent(gateView)}`), renderGate, {
       sealedMsg: 'Archons only. Access requests are not visible at your rank.',
       errMsg: 'Could not load access requests.',
       name: 'gate',
@@ -782,23 +871,19 @@
       trendEl.innerHTML = emptyStateHtml('No trend to show yet.');
       return;
     }
-    const maxN = Math.max(1, ...trend.map((t) => num(t.n)));
+    // task 1003445: this was the hall's third copy of the same horizontal bar.
+    // It draws through OTBKit.barSeriesHtml now, in the NEUTRAL tone — on an
+    // oversight page the accent belongs to the pressable, not to the data —
+    // with its own geometry passed as options rather than a second class family.
     trendEl.innerHTML =
-      '<div class="watch-trend">' +
-      trend
-        .map((t) => {
-          const w = Math.round((num(t.n) / maxN) * 100);
-          const avg = (t.avg_score ?? '—') === '—' ? '—' : escapeHtml(String(t.avg_score));
-          return (
-            '<div class="watch-trend__row">' +
-            `<span>${escapeHtml(fmtDay(t.day))}</span>` +
-            `<span class="watch-trend__bar-track"><span class="watch-trend__bar-fill" style="width:${w}%"></span></span>` +
-            `<span class="watch-trend__val">${fmtInt(t.n)} · ${avg}</span>` +
-            '</div>'
-          );
-        })
-        .join('') +
-      '</div>' +
+      window.OTBKit.barSeriesHtml(
+        trend.map((t) => ({
+          label: fmtDay(t.day),
+          value: num(t.n),
+          valueLabel: `${fmtInt(t.n)} · ${(t.avg_score ?? '—') === '—' ? '—' : String(t.avg_score)}`,
+        })),
+        { tone: 'neutral', labelWidth: '64px', valueWidth: '96px', barHeight: '6px', pill: true },
+      ) +
       foot('Per day: ships graded · avg score.');
   }
 

package/modules/platform-identity/platform-identity.js

@@ -313,6 +313,13 @@ const {
   publishGatePort,
 } = require('./publish-gate');
 
+// The public projects feed — who is on the map, and what each row may say (ADR 0182
+// D1/D2a/D3; R06, task 1002325). Its own file for the publish-gate.js reason: this
+// file is at the size ratchet. Re-exported below, so the surface is unchanged.
+const {
+  ORB_BY_STATE, orbForState, isStealthProject, feedShapeFor, listPublicProjects,
+} = require('./projects-feed');
+
 // Upsert a catalog row (keyed by origin). Called when a client registers (so every
 // federated project is catalogued, unfeatured) and by the Archon create/curate route.
 // Never touches `featured` on update — that is Archon-only via setProjectFeatured.
@@ -360,21 +367,9 @@ async function getProject(id, { pool = defaultPool } = {}) {
   return { ...rows[0], ...projectPublishability(rows[0]) };
 }
 
-// The PUBLIC Explore listing — featured + active projects only, public projection
-// (no owner_github_id, no status). Newest first. created_at is the LISTED date —
-// when the hub first catalogued the row, not when the project began — and the
-// card labels it "Listed" for exactly that reason (task 1002778). updated_at may
-// sort but is never projected: feature toggles and client re-registration bump
-// it, so as a public "last updated" it would lie.
-async function listFeaturedProjects({ pool = defaultPool } = {}) {
-  const { rows } = await pool.query(
-    `SELECT origin, name, tagline, art_url, type, template, created_at
-       FROM platform_identity_projects
-      WHERE featured = true AND status = 'active'
-      ORDER BY updated_at DESC`,
-  );
-  return rows;
-}
+// The PUBLIC projects feed lives in projects-feed.js (R06, task 1002325) — the
+// predicate, the orb mapping and the stealth redaction are one concern, and each is
+// only safe given the other two.
 
 // The curation list — every active project, its featured flag, its stored door, and the
 // DERIVED publish verdict. `publishable` is computed in SQL from publishableSql() so this
@@ -779,10 +774,15 @@ function isNumericGithubId(githubId) {
 // table, the disciplines union computed separately (never a pre-GROUP-BY unnest
 // fan-out — bug task 1002911). Per-project rows join the module-internal
 // client_id → sso_clients.origin → projects.origin two-hop; a project is NAMED
-// only when its catalog row is publicly listed today (featured + active — the
-// exact set listFeaturedProjects publishes; goal 1000046's visibility states
-// will widen this predicate when they land). Everything else is counted in
-// more_projects, never named ("the aggregate is not the leak, the name is").
+// only when its catalog row is publicly listed today (featured + active).
+// Everything else is counted in more_projects, never named ("the aggregate is
+// not the leak, the name is").
+//
+// Deliberately NARROWER than the public feed since R06 (task 1002325), and left so
+// rather than widened here: a STEALTH project is on the map ANONYMOUSLY (ADR 0182
+// D2a), so naming it in a builder's profile would be the leak the feed exists to
+// prevent, and how much of a record may be NAMED is ADR 0171 D2's question, not
+// R06's. Narrower under-names, which is safe. The widening is its own task.
 // client_id never appears in the returned shape.
 async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
   if (!isNumericGithubId(githubId)) return null;
@@ -1436,9 +1436,13 @@ module.exports = {
   PROJECT_MATERIALS,
   PROJECT_SHAPES,
   getProject,
-  listFeaturedProjects,
+  listPublicProjects,
   listAllProjects,
   setProjectFeatured,
+  ORB_BY_STATE,
+  orbForState,
+  isStealthProject,
+  feedShapeFor,
   // memberships
   MEMBERSHIP_KINDS,
   membershipKindFromLegacy,

package/modules/platform-identity/projects-feed.js

@@ -0,0 +1,142 @@
+// modules/platform-identity/projects-feed.js — THE public projects feed: WHO is on
+// the map, and WHAT each row is allowed to say (R06, task 1002325; ADR 0182 D1/D2a/D3).
+// The in-repo lever the orbs page reads. The publish-gate.js precedent — one question,
+// one file, so no two surfaces can answer it differently.
+//
+// THREE ANSWERS, and they belong together because each is only safe given the others:
+//
+//   • WHO — `listPublicProjects`. A project is on the map iff `status = 'active' AND
+//     publishable`, the derived identity gate, taken from publishableSql() so this feed
+//     and the curation list read ONE definition. It used to be `featured = true`, which
+//     made Archon curation load-bearing for visibility at all: an owner could set their
+//     project public and see nothing happen (ADR 0182 D3). `featured` keeps the only job
+//     D3 leaves it — RANKING among rows already on the map. Dark matter is excluded HERE,
+//     in SQL, because a client-side filter ships the husk to anyone who opens a network tab.
+//
+//   • WHAT IT DRAWS AS — `orbForState`, the ADR 0182 D1 mapping:
+//        public → planet   (identified, anyone may join)
+//        private → star    (identified, no self-join, applications accepted)
+//        stealth → black hole (ANONYMOUS, no self-join, applications refused)
+//     Three surfaces render it — this feed, Explore (R07, task 1002326) and the static
+//     orbs site (R09, task 1002328) — and the last is a different repo. A mapping copied
+//     into each is a mapping that drifts.
+//
+//   • WHAT IT MAY SAY — `feedShapeFor`, the D2a privacy boundary in code: a stealth
+//     project exposes EXISTENCE, never IDENTITY. Redaction is server-side because the
+//     naive version sends the row and lets the orbs page hide it, which leaks the whole
+//     project to anyone who opens the network tab — and that page is a static site
+//     outside this repo, so we could not enforce it there even in principle.
+//
+// TWO DELIBERATE FAIL-CLOSED CHOICES, because this is a privacy boundary, not a
+// rendering detail:
+//   1. AN UNKNOWN STATE DRAWS AS A BLACK HOLE. A fourth enum value added later and not
+//      mapped here would otherwise ship its project's name as a planet.
+//   2. THE STEALTH SHAPE IS AN ALLOW-LIST, NOT A DENY-LIST — everything is nulled except
+//      the two keys a black hole may carry, so a column added to the feed next year is
+//      anonymous without anyone remembering to come back here. A deny-list of "the
+//      identifying fields" is correct exactly until the feed grows.
+//
+// WHY ITS OWN FILE. The account-visibility.js / publish-gate.js reason: platform-identity.js
+// sits at the file-size ratchet. The caller-facing symbols (listPublicProjects, feedShapeFor,
+// orbForState, isStealthProject, ORB_BY_STATE) are re-exported there so the module's public
+// surface is unchanged; orbStateOf, FALLBACK_PROJECT_STATE and STEALTH_ANONYMOUS_KEEPS are
+// this file's own internals and are reached only from here and its test.
+// Proof: ../../tests/visible_projects_feed.mjs
+'use strict';
+
+const { pool: defaultPool } = require('../../src/module-api');
+const { publishableSql } = require('./publish-gate');
+
+// ADR 0182 D1's mapping, and the only copy of it in the repo. The three words are locked
+// by goal 1000046's `proj-visibility-states` criterion, not chosen here.
+const ORB_BY_STATE = Object.freeze({
+  public: 'planet',
+  private: 'star',
+  stealth: 'black-hole',
+});
+
+// What an unrecognised (or absent) stored value is treated as — the ANONYMOUS state,
+// deliberately. A project whose door we cannot read is one whose name we must not publish.
+const FALLBACK_PROJECT_STATE = 'stealth';
+
+// The ONLY keys a black hole may carry; everything else on the row is nulled. No stable
+// per-project key appears here on purpose: an id, a slug or a hash of the origin would
+// each let an observer who kept yesterday's public feed name the project that went stealth
+// today. Black holes are interchangeable, which is the whole point of the metaphor.
+const STEALTH_ANONYMOUS_KEEPS = Object.freeze(['state', 'orb']);
+
+// The stored join door, normalised to a state this file knows. Never echoes an
+// unvalidated value onto the wire.
+function orbStateOf(visibility) {
+  const v = String(visibility ?? '').trim();
+  return Object.prototype.hasOwnProperty.call(ORB_BY_STATE, v) ? v : FALLBACK_PROJECT_STATE;
+}
+
+// The render type for a state — the one mapping R07 and R09 both read. PURE.
+function orbForState(state) {
+  return ORB_BY_STATE[orbStateOf(state)];
+}
+
+// Is this row anonymous on the map? Exported so the feed route can keep a stealth
+// project's origin out of the per-project enrichment fetches entirely — asking its own
+// public API for its builders' avatars would both put identity on the wire and tell that
+// project it was being enumerated.
+function isStealthProject(project) {
+  return orbStateOf(project?.visibility) === 'stealth';
+}
+
+// ONE catalog row → the public wire row. Spends `visibility` deriving `state` + `orb` (it
+// never doubles it on the wire), then either passes the identified row through or rebuilds
+// it from the allow-list above. The redaction NULLS rather than DELETES: the feed's
+// standing contract is that an unanswerable value is null and never absent, because
+// JSON.stringify drops the absent one and a client would read `undefined` on some rows and
+// null on others. A redacted row is a full-width row that says nothing. PURE.
+function feedShapeFor(project) {
+  const { visibility, ...rest } = project || {};
+  const state = orbStateOf(visibility);
+  const shaped = { ...rest, state, orb: ORB_BY_STATE[state] };
+  if (state !== 'stealth') return shaped;
+  const anonymous = {};
+  for (const key of Object.keys(shaped)) {
+    anonymous[key] = STEALTH_ANONYMOUS_KEEPS.includes(key) ? shaped[key] : null;
+  }
+  return anonymous;
+}
+
+// The feed's hard ceiling. Until R06 the listing was bounded by an Archon choosing to
+// feature a project; the swap to `publishable` replaced that human bound with self-service,
+// on a route that is public, CORS-open, unauthenticated AND drives one outbound stats fetch
+// per row. A cap is the cheap half of that trade — the honest half is pagination, which is
+// its own task; this constant only stops the tail from being unbounded meanwhile. Set far
+// above the live catalog, so it truncates nothing today.
+const PUBLIC_FEED_MAX_PROJECTS = 500;
+
+// Every project ON THE MAP, in the public projection (no owner_github_id, no status).
+// `visibility` is projected because feedShapeFor() derives each row's state + orb from it;
+// it is spent there and never reaches the wire. created_at is the LISTED date — when the
+// hub first catalogued the row, not when the project began (task 1002778). updated_at may
+// sort but never projects: feature toggles and client re-registration bump it, so as a
+// public "last updated" it would lie. `description` is the publish BAR, spent in the
+// predicate, never a card field.
+async function listPublicProjects({ pool = defaultPool } = {}) {
+  const { rows } = await pool.query(
+    `SELECT origin, name, tagline, art_url, type, template, created_at, visibility
+       FROM platform_identity_projects
+      WHERE status = 'active' AND ${publishableSql()}
+      ORDER BY featured DESC, updated_at DESC
+      LIMIT ${PUBLIC_FEED_MAX_PROJECTS}`,
+  );
+  return rows;
+}
+
+module.exports = {
+  ORB_BY_STATE,
+  FALLBACK_PROJECT_STATE,
+  STEALTH_ANONYMOUS_KEEPS,
+  orbStateOf,
+  orbForState,
+  isStealthProject,
+  feedShapeFor,
+  PUBLIC_FEED_MAX_PROJECTS,
+  listPublicProjects,
+};